Analyzing CVE-2026-85706: Unauthenticated Path Traversal in GitLab

A critical path traversal vulnerability in GitLab, tracked as CVE-2026-85706, exposes self-hosted Community Edition (CE) and Enterprise Edition (EE) instances to unauthenticated arbitrary file disclosure. The flaw stems from missing authentication enforcement on specific endpoints within the repository commits API, combined with improper path confinement when the application processes commit-related path requests.

Understanding the Attack Vector

Exploitation targets the repository commits API. Under normal operation, API endpoints handling commit histories, file diffs, or blob references require a valid authentication token and strictly confine directory paths to the underlying repository store. In this case, an authorization bypass leaves the commit endpoint accessible to unauthenticated remote users.

By sending crafted requests containing relative path traversal sequences (such as ../ or encoded variations like %2e%2e%2f), an attacker can escape the repository root directory (typically located under /var/opt/gitlab/git-data/repositories). Because the application process handles the file read without validating that the targeted canonical path remains within the designated directory structure, the API returns raw filesystem contents directly in the HTTP response.

From Arbitrary File Read to Full Compromise

While path traversal vulnerabilities only grant read access, in a DevOps platform like GitLab an arbitrary file read frequently serves as the first step in a complete system takeover. Attackers typically follow a well-defined operational chain:

1. Secret Harvesting: Attackers target configuration files such as /etc/gitlab/gitlab.rb and /etc/gitlab/gitlab-secrets.json. These files store database credentials, secret tokens, and cryptographic keys—most notably db_key_base and secret_key_base.
2. Session and Token Forgery: Possession of db_key_base or secret_key_base allows an attacker to forge arbitrary session cookies or decrypt stored access tokens, elevated API keys, and runner registration credentials offline.
3. Privilege Escalation & Code Execution: Armed with forged administrative credentials or stolen CI/CD runner tokens, the attacker converts the initial file read into full administrative access, enabling remote code execution, repository tampering, or supply chain poisoning across CI/CD pipelines.

High-Risk Deployment Patterns

Internet-facing, self-hosted GitLab CE/EE instances represent the primary attack surface. Organizations that host proprietary source code, manage infrastructure-as-code (IaC) deployment pipelines, or store sensitive deployment credentials inside GitLab environments face severe risk. Because exploitation requires no prior account, valid credentials, or user interaction, vulnerable instances can be identified and exploited automatically via wide-scale scanning.

Remediation and Threat Hunting

Organizations running affected versions of GitLab Community Edition or Enterprise Edition must immediately update their installations to the latest vendor-supplied patch release addressing CVE-2026-85706. If patching cannot be performed immediately, block external access to the GitLab API or place the instance behind a strict access control list or VPN.

To investigate whether your environment was targeted prior to patching, review your GitLab Rails API logs (/var/log/gitlab/gitlab-rails/api_json.log):

• Search for HTTP GET requests hitting endpoints under /api/v4/projects/:id/repository/commits/.
• Inspect query parameters and path arguments for directory traversal payloads, including ../, ..%2f, %2e%2e%2f, or double-encoded variants.
• Filter for unauthenticated requests (where user_id or username fields are null or unpopulated) returning 200 OK responses for commit file queries.

If forensic analysis reveals successful reads of sensitive system files like gitlab-secrets.json, assume the entire instance and associated credentials have been compromised. Apply the vendor update immediately, rotate all application secret keys, reset user sessions, and rotate all database passwords and CI/CD secrets managed within the platform.